pki-profiles-ldap: flesh out design